Token Abuse Sits in the Gaps
Creating a fake account is cheap. GPU-backed inference is expensive. As long as abuse costs less than the compute it buys, attackers keep coming back.
If you ship an AI product with a free tier, a public API, or per-seat pricing, that arithmetic is your problem. Stripe's CEO has said that roughly one in six new account attempts on AI platforms is fraudulent, and that free-trial abuse more than doubled in six months. For some heavily targeted AI companies, around a quarter of authentication attempts end up blocked.
The traditional toolkit fits this badly. Fraud platforms were built to catch dishonest humans using stolen cards and synthetic identities. Bot management was built to catch scrapers and credential stuffers. Neither was designed around a product whose most expensive resource is a GPU cycle, and whose attackers increasingly are AI agents themselves. Token abuse sits in the gap between the two, and it takes six forms.
1. Public API scraping and reverse engineering
Low-and-slow probing maps your endpoints, parameters and rate limits. Once an attacker knows where the edges are, they can automate just inside them at scale. A rate limit on its own won't catch this, because each individual request looks fine. The giveaway is the sequence: the order of calls, the velocity across endpoints, the shape of the payloads.
2. Stolen and leaked API keys
Keys harvested from public repositories, logs and breaches get resold, then run against your inference endpoints on someone else's budget. The key is valid, so authentication passes. What gives it away is everything around the key: a new device, a new network and a new behavioral profile all appearing at once on a credential that has never behaved that way.
3. Freemium compute farming
Scripted multi-accounting harvests free image, video or LLM generations one throwaway signup at a time. Attackers cycle accounts, exhaust the trial credits, delete and recreate. When a payment method gates the trial, they buy stolen cards in bulk to get past it. Each free generation is a real GPU cycle you paid for, and a single operator can run thousands of them.
4. Account sharing and credential reselling
Some operators create a verified, paid account once, clear it, and sell access. Downstream buyers then push many unauthorized users through a single seat's quota. Your per-seat pricing quietly turns into one seat for everyone, and your revenue model absorbs the difference.
5. Account takeover for compute theft
Credential stuffing doesn't always go after money. Sometimes the target is your legitimate customer's unused quota. The attacker logs in, burns the compute, and leaves the customer to discover the bill or the exhausted allowance later.
6. Distributed model distillation
This one has the longest-term cost. Attackers send enormous volumes of carefully structured queries and train a cheaper model on the outputs, copying capabilities you spent years building. To avoid per-account and per-IP limits they spread the work across thousands of fraudulent accounts, proxy services and shared payment methods.
The scale is documented. Anthropic has published details of three coordinated distillation campaigns involving roughly 24,000 fraudulent accounts and more than 16 million exchanges. The traffic used coordinated timing and highly repetitive prompt structures, and none of it looked unusual at the level of a single account.
Why point solutions miss it
Fraud scoring tends to report after the fact and has little concept of an AI agent or of GPU-backed abuse. Bot management is fast at the edge, but without an identity or behavioral layer, a cleaned-up device passes straight through. Each tool sees one slice. Token abuse shows up across slices: the same operator behind many accounts, the same key on new devices, the same automation fingerprint behind a hundred signups.
These attacks may look different on the surface, but they share a common goal: turning legitimate AI access into unauthorized compute consumption. For a deeper look at the techniques behind these attacks and the signals that can help expose them, explore our white paper on AI token abuse and API compute theft.
How the intent layer stops it
Darwinium builds one Behavioral Identity Graph from device, identity, biometrics and behavior, across web, mobile and API. Every request is classified in real time and acted on in the request path, before it reaches your backend. The response can be to permit, verify, challenge, redirect or terminate, and because the decision happens at the edge, it happens before the token is spent.
Here is how that applies to each of the six patterns.
- Scraping becomes visible when you monitor request sequence, velocity and payload structure across endpoints. That reveals the reconnaissance a rate limit never sees.
- A stolen key gets flagged by how it is used. A valid key arriving from an unfamiliar device, network and behavioral profile at the same moment is a signal in itself.
- Compute farming stops when throwaway signups are linked back to the same device, click farm or automation fingerprint before the free-tier generations run.
- Account sharing surfaces when the identity graph connects concurrent access patterns back to one shared credential, even across different devices and locations.
- Takeover shows up as a continuity break. A stolen credential doesn't carry the owner's typing rhythm or session history, so the mismatch appears even on a clean device.
- Distillation is detected by clustering. Shared payment methods, coordinated timing and repetitive prompt structure link thousands of accounts back to one operator.
Darwinium scores the intent behind an interaction and doesn't need to know who the person is, so none of this depends on collecting personal data. You can understand the why without needing to know who. It deploys at the CDN edge alongside the infrastructure you already run, with no changes to your backend code.
If your product gives away compute, someone is already working out how to collect it at scale, and the cheapest place to stop them is at the edge, before the request spends a GPU cycle.
You can see it classify real traffic in the live demo or, read our White Paper - Stopping Token & API Abuse Before It Drains Your Compute Budget.